Merge pull request #9311 from decentraland/release/2026-07-06

release: 2026-07-06

Author: anicalbano

.github/auto_assign_config_dev.yml

@@ -17,9 +17,6 @@ reviewGroups:
     - pravusjif
     - NickKhalow
     - lorenzo-ranciaffi
-    - biotech77
-    - sandrade-dcl
-    - Maurizio-dcl
 
 filterLabels:
   exclude:

.github/workflows/build-release-main.yml

@@ -31,7 +31,10 @@ jobs:
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "> ⚠️ If some artefacts are missing please take a look at previous attempts" >> $GITHUB_STEP_SUMMARY
 
-  # Run a clean build (no cache)
+  # Enable cache reuse for release builds: cache_strategy=library turns on the remote
+  # library/shader cache and clean_build=false lets the build consume it. The shared,
+  # dev-isolated release/hotfix/main cache pool (cold genesis) is wired in build.py's
+  # clone_current_target.
   build:
     name: Build Unity Cloud
     needs: get-info
@@ -41,8 +44,8 @@ jobs:
     uses: ./.github/workflows/build-unitycloud.yml
     with:
       profile: none
-      clean_build: true
-      cache_strategy: none
+      clean_build: false
+      cache_strategy: library
       version: ${{ needs.get-info.outputs.version }}
       sentry_enabled: true
       is_release_build: true

.github/workflows/claude-pr-review.yml

@@ -6,15 +6,79 @@ on:
   pull_request_review_comment:
     types: [created]
   pull_request:
-    types: [opened, synchronize, ready_for_review]
+    types: [opened, synchronize, ready_for_review, labeled]
 
 jobs:
-  auto-review:
+  check-author:
     if: |
       github.event_name == 'pull_request' &&
       github.event.pull_request.draft == false &&
+      github.event.pull_request.user.login != 'github-actions[bot]' &&
+      !startsWith(github.head_ref, 'release/') &&
       !contains(github.event.pull_request.labels.*.name, 'no review') &&
-      !contains(github.event.pull_request.labels.*.name, 'auto-pr')
+      !contains(github.event.pull_request.labels.*.name, 'auto-pr') &&
+      (github.event.action != 'labeled' || github.event.label.name == 'ext-contribution')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      is-team-dev: ${{ steps.check.outputs.is-team-dev }}
+    steps:
+      - name: Check for ext-contribution label
+        id: label-check
+        run: |
+          if [[ "${{ contains(github.event.pull_request.labels.*.name, 'ext-contribution') }}" == "true" ]]; then
+            echo "has-label=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has-label=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Checkout config file
+        if: steps.label-check.outputs.has-label != 'true'
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          sparse-checkout: .github/auto_assign_config_dev.yml
+          fetch-depth: 1
+
+      - name: Check if PR author is a team dev
+        id: check
+        env:
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+        run: |
+          if [[ "${{ steps.label-check.outputs.has-label }}" == "true" ]]; then
+            echo "Author $PR_AUTHOR has ext-contribution label — treating as external"
+            echo "is-team-dev=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          TEAM_DEVS=$(yq eval '.reviewGroups | .[] | .[]' .github/auto_assign_config_dev.yml)
+          echo "Team devs:"
+          echo "$TEAM_DEVS"
+          if echo "$TEAM_DEVS" | grep -qxF "$PR_AUTHOR"; then
+            echo "Author $PR_AUTHOR is a team dev"
+            echo "is-team-dev=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Author $PR_AUTHOR is NOT a team dev"
+            echo "is-team-dev=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Add ext-contribution label for non-team PRs
+        if: |
+          steps.check.outputs.is-team-dev == 'false' &&
+          steps.label-check.outputs.has-label != 'true' &&
+          (github.event.action == 'opened' || github.event.action == 'ready_for_review')
+        env:
+          GH_TOKEN: ${{ secrets.ORG_ACCESS_TOKEN }}
+        run: |
+          gh pr edit ${{ github.event.pull_request.number }} --add-label ext-contribution --repo ${{ github.repository }} || echo "::warning::Could not add label (expected for fork PRs)"
+          echo "Added ext-contribution label to PR #${{ github.event.pull_request.number }}"
+
+  auto-review:
+    needs: check-author
+    if: |
+      needs.check-author.result == 'success' &&
+      needs.check-author.outputs.is-team-dev == 'true'
     runs-on: ubuntu-latest
     concurrency:
       group: claude-auto-review-${{ github.event.pull_request.number }}
@@ -296,6 +360,90 @@ jobs:
           gh run rerun "$WORKFLOW_RUN_ID" --repo "${{ github.repository }}"
           echo "Re-run triggered successfully."
 
+  notify-ext-contribution:
+    needs: check-author
+    if: |
+      needs.check-author.result == 'success' &&
+      needs.check-author.outputs.is-team-dev == 'false' &&
+      github.event.action == 'labeled' &&
+      github.event.label.name == 'ext-contribution'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Check for existing Slack notification marker
+        id: dedup
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          MARKER="<!-- ext-contribution-slack-sent -->"
+          COMMENTS=$(gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments?per_page=100" --jq '.[].body')
+          if echo "$COMMENTS" | grep -qF "$MARKER"; then
+            echo "Slack notification already sent for this PR — skipping"
+            echo "already-sent=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "already-sent=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Verify PR author is a decentraland org member
+        if: steps.dedup.outputs.already-sent != 'true'
+        id: check-org
+        env:
+          GH_TOKEN: ${{ secrets.ORG_ACCESS_TOKEN }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+        run: |
+          if gh api "/orgs/decentraland/members/$PR_AUTHOR" --silent 2>/dev/null; then
+            echo "is-member=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::notice::PR author $PR_AUTHOR is not a member of decentraland org; Slack notification skipped"
+            echo "is-member=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Extract Slack requester tag from PR description
+        if: steps.dedup.outputs.already-sent != 'true' && steps.check-org.outputs.is-member == 'true'
+        id: extract-slack-tag
+        env:
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          SLACK_TAG=$(echo "$PR_BODY" | grep -oP '(?<=Requested by ).*?(\(<@U[A-Z0-9]+>\))' | grep -oP '<@U[A-Z0-9]+>' | head -1)
+          if [ -n "$SLACK_TAG" ]; then
+            echo "Found Slack tag: $SLACK_TAG"
+            echo "slack-tag=$SLACK_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "No Slack tag found in PR description, will use GitHub username"
+            echo "slack-tag=" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Post to Slack #explorer-ext-contributions
+        if: steps.dedup.outputs.already-sent != 'true' && steps.check-org.outputs.is-member == 'true'
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.EXPLORER_EXT_CONTRIBUTIONS_WEBHOOK }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_AUTHOR_LOGIN: ${{ github.event.pull_request.user.login }}
+          SLACK_TAG: ${{ steps.extract-slack-tag.outputs.slack-tag }}
+        run: |
+          if [ -n "$SLACK_TAG" ]; then
+            AUTHOR_REF="$SLACK_TAG"
+          else
+            AUTHOR_REF="$PR_AUTHOR_LOGIN"
+          fi
+          PAYLOAD=$(jq -n --arg url "$PR_URL" --arg author "$AUTHOR_REF" \
+            '{"text": "<@U0AJ91P1KBP> review \($url) (initiated by \($author))"}')
+          curl -fsS -X POST "$SLACK_WEBHOOK_URL" \
+            -H 'Content-Type: application/json' \
+            -d "$PAYLOAD"
+
+      - name: Post dedup marker comment
+        if: steps.dedup.outputs.already-sent != 'true' && steps.check-org.outputs.is-member == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \
+            -f body="<!-- ext-contribution-slack-sent -->
+          Slack notification sent to #explorer-ext-contributions for external review.
+          To re-send, delete this comment and re-add the \`ext-contribution\` label."
+
   check-member:
     if: |
       github.event.issue.pull_request != null &&

.github/workflows/pr-comment-warnings.yml

@@ -56,16 +56,19 @@ jobs:
           fi
           count=$(jq -r '.count' warning-result.json)
           baseline=$(jq -r '.baseline // ""' warning-result.json)
+          allow_equal=$(jq -r '.allow_equal // false' warning-result.json)
           echo "found=true" >> "$GITHUB_OUTPUT"
           echo "count=$count" >> "$GITHUB_OUTPUT"
           echo "baseline=$baseline" >> "$GITHUB_OUTPUT"
+          echo "allow-equal=$allow_equal" >> "$GITHUB_OUTPUT"
 
       - name: Compose comment body
         if: steps.result.outputs.found == 'true'
         id: body
         env:
           COUNT: ${{ steps.result.outputs.count }}
           BASELINE: ${{ steps.result.outputs.baseline }}
+          ALLOW_EQUAL: ${{ steps.result.outputs.allow-equal }}
         run: |
           {
             echo "body<<EOF"
@@ -74,6 +77,8 @@ jobs:
               echo "**Warnings counted: $COUNT** (no baseline established yet)"
             elif [ "$COUNT" -lt "$BASELINE" ]; then
               echo "**Warnings count reduced: $BASELINE => $COUNT**"
+            elif [ "$ALLOW_EQUAL" = "true" ] && [ "$COUNT" -eq "$BASELINE" ]; then
+              echo "**Warnings unchanged: $BASELINE => $COUNT** — allowed on release/hotfix branches."
             else
               echo "**Warnings not reduced: $BASELINE => $COUNT** — remove at least one warning to merge."
             fi

.github/workflows/test.yml

@@ -87,8 +87,12 @@ jobs:
 
     name: Lint
     runs-on: ubuntu-latest
+    # PRs from or into a release/hotfix branch may merge with an unchanged warning count
+    # (equality passes the ratchet below); the dev line still requires a strict reduction.
+    env:
+      IS_RELEASE_OR_HOTFIX: ${{ startsWith(github.head_ref, 'release/') || startsWith(github.head_ref, 'hotfix/') || startsWith(github.base_ref, 'release/') || startsWith(github.base_ref, 'hotfix/') }}
     steps:
-
+      
       - name: Checkout CI actions
         uses: actions/checkout@v6
         with:
@@ -259,17 +263,73 @@ jobs:
       - name: Download ReSharper Command Line Tools
         run: bash scripts/lint/download-resharper.sh rsharp
 
-      - name: Run ReSharper InspectCode (static analysis)
-        run: bash scripts/lint/run-inspectcode.sh Explorer/Explorer.sln "$INSPECT_REPORT_JSON_FILE_NAME"
-
-      # Filter false positives ('.CSharpErrors'/'.CppCompilerErrors' from '--no-build') and count.
+      # The ReSharper CLI needs a .NET runtime, which the Unity image lacks.
+      # Derive an image with the SDK (runtime + MSBuild for project-model evaluation)
+      - name: Build lint image with .NET SDK
+        id: lint-dotnet-img
+        run: |
+          base="${{ steps.img-lint.outputs.ghcr }}"
+          derived="${base}-dotnet"
+          cat > /tmp/Dockerfile.dotnet <<EOF
+          FROM $base
+          RUN apt-get update \
+              && apt-get install -y --no-install-recommends dotnet-sdk-8.0 \
+              && rm -rf /var/lib/apt/lists/*
+          EOF
+          docker build -t "$derived" -f /tmp/Dockerfile.dotnet /tmp
+          echo "image=$derived" >> "$GITHUB_OUTPUT"
+
+      # The solution generated by the GameCI step above bakes in absolute paths only valid there ('/opt/unity/...', and the
+      # workspace as '/github/workspace' — the exact path GameCI mounts it at, so the -v
+      # target below must match it). Running on the host leaves those references dangling
+      # and ReSharper resolves them heuristically per-run
+      - name: Run ReSharper InspectCode (inside Unity container)
+        run: |
+          docker run --rm \
+            -v "${{ github.workspace }}:/github/workspace" \
+            -w /github/workspace \
+            -e RSHARP_HOME=/github/workspace/rsharp \
+            -e HOME=/tmp \
+            "${{ steps.lint-dotnet-img.outputs.image }}" \
+            bash scripts/lint/run-inspectcode.sh Explorer/Explorer.sln "$INSPECT_REPORT_JSON_FILE_NAME"
+
+      # Filter false positives ('.CSharpErrors'/'.CppCompilerErrors', residual unresolved-ref noise) and count.
       - name: Count warnings
         id: warnings
         uses: ./.github/actions/count-warnings
         with:
           report: ${{ env.INSPECT_REPORT_JSON_FILE_NAME }}
           filtered_output: filtered.json
 
+      # With full in-container resolution, C# compiler-level diagnostics should be near
+      # zero (baseline: 11 stable Google.Protobuf Span-overload quirks). A spike means
+      # references stopped resolving (image change, GameCI mount path change) and the
+      # warning count is measuring environment breakage, not code - fail loudly instead
+      # of letting filter-warnings.sh discard the evidence. Only '.CSharpErrors' counts:
+      # '.CppCompilerErrors' is ReSharper's shader/C++ analyzer noise (~500 in .hlsl/
+      # .cginc files), unrelated to C# resolution health.
+      - name: Assert reference resolution is healthy
+        run: |
+          set -euo pipefail
+          errs=$(jq '[.runs[0].results[] | select(.ruleId == ".CSharpErrors")] | length' "$INSPECT_REPORT_JSON_FILE_NAME")
+          echo "C# compiler-error diagnostics in report: $errs (filtered warning count: ${{ steps.warnings.outputs.count }})"
+          if [ "$errs" -gt 20 ]; then
+            echo "::error::$errs C# compiler-level errors in the InspectCode report - references are not resolving, the warning count cannot be trusted."
+            exit 1
+          fi
+
+      # Keep the raw and filtered reports inspectable for investigation purposes in a case of failure from "Assert reference resolution is healthy"
+      - name: Upload InspectCode reports
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: inspect-code-reports
+          path: |
+            ${{ env.INSPECT_REPORT_JSON_FILE_NAME }}
+            filtered.json
+          if-no-files-found: ignore
+          retention-days: 3
+
       - name: Read warnings baseline from S3
         id: baseline
         env:
@@ -285,6 +345,7 @@ jobs:
           echo "Baseline warnings: ${baseline:-<none>}"
 
       # Hard gate: a PR may only merge if it strictly reduces the warning count.
+      # Exception: release/hotfix PRs may merge when the count is unchanged (equality passes).
       # No baseline yet -> pass (the first dev push seeds it). Add the 'no-warning-ratchet'
       # label to bypass on a PR that legitimately cannot touch warnings.
       - name: Enforce warning reduction (PR)
@@ -302,6 +363,10 @@ jobs:
             echo "Warnings reduced: $COUNT < $BASELINE"
             exit 0
           fi
+          if [ "$IS_RELEASE_OR_HOTFIX" = "true" ] && [ "$COUNT" -eq "$BASELINE" ]; then
+            echo "Warnings unchanged ($COUNT == $BASELINE) on a release/hotfix branch - passing."
+            exit 0
+          fi
           if [ "$BYPASS" = "true" ]; then
             echo "::warning::Warnings not reduced ($COUNT >= $BASELINE) but 'no-warning-ratchet' label present - bypassing."
             exit 0
@@ -350,7 +415,8 @@ jobs:
             --argjson pr "${{ github.event.pull_request.number }}" \
             --argjson count "$COUNT" \
             --arg baseline "$BASELINE" \
-            '{pr: $pr, count: $count, baseline: (if $baseline == "" then null else ($baseline | tonumber) end)}' \
+            --argjson allow_equal "$IS_RELEASE_OR_HOTFIX" \
+            '{pr: $pr, count: $count, baseline: (if $baseline == "" then null else ($baseline | tonumber) end), allow_equal: $allow_equal}' \
             > warning-result.json
           cat warning-result.json
 

CLAUDE.md

@@ -103,7 +103,7 @@ A `Stop` hook (`.claude/settings.json` → [`scripts/lint/lint-changed.sh`](scri
   * Ignore `OperationCanceledException`
   * Log/report all others via `ReportHub.LogException`
 * Use `SuppressToResultAsync()` to simplify exception handling.
-* Handle cancellation with `ct.IsCancellationRequested`, never `ThrowIfCancellationRequested()`.
+* In exception-free flows (detached UniTask, `.Forget()`, fire-and-forget, returning boolean, returning Result or Result<T>), handle cancellation with `ct.IsCancellationRequested` — do not use `ThrowIfCancellationRequested()`. In flows that already handle exceptions (awaited async methods, `SuppressToResultAsync`), `ThrowIfCancellationRequested()` is acceptable.
 
 ### 10. **Testing Systems**
 

Explorer/Assets/DCL/AuthenticationScreenFlow/States/IdentityVerificationOTPAuthState.cs

@@ -75,7 +75,7 @@ public override void Exit()
                     Exception ex => new SpanErrorInfo("Unexpected error during authentication flow", ex),
                 };
 
-                if (loginException is not OperationCanceledException)
+                if (loginException is not OperationCanceledException && loginException is not InvalidEmailException)
                     ReportHub.LogException(loginException, new ReportData(ReportCategory.AUTHENTICATION));
             }
 
@@ -100,7 +100,7 @@ private async UniTaskVoid AuthenticateAsync(string email, CancellationToken ct)
 
                 // awaits OTP code being entered
                 IWeb3Identity identity = await compositeWeb3Provider.LoginAsync(LoginPayload.ForOtpFlow(email), ct);
-                machine.Enter<ProfileFetchingAuthState, ProfileFetchingPayload>(new (email, identity, false, ct));
+                machine.Enter<ProfileFetchingAuthState, ProfileFetchingPayload>(new ProfileFetchingPayload(email, identity, false, ct));
             }
             catch (OperationCanceledException e)
             {